How to use the HTTP status code list
- Type a code, a name or a keyword into Search by code, name or keyword:
404,teapot,rate limit, or5xxfor a whole class. - Press 1xx to 5xx or Unofficial to narrow the list. The line under the buttons tells you how many codes match.
- Click a code number to link to that entry, for example
/tools/http-status-codes#404.
How status codes are grouped
The first digit is the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error and 5xx server error. The list covers every code in the IANA HTTP Status Code Registry (checked October 2026), using the names from RFC 9110 section 15. That includes the 2022 renames: 413 is now Content Too Large and 422 is now Unprocessable Content. A separate Unofficial group holds nginx 499 and Cloudflare 520 to 530, which are common in logs but not standard.
Worked example
On load the search box is empty and the line under the buttons reads Showing all 73 status codes. Type 404 and it reads Showing 1 of 73 status codes, leaving the entry 404 Not Found: "The server cannot find the requested resource. It may never have existed, or it may be missing for now." Clear the box, type redirect and you get 300 to 308, the whole 3xx class, including 301 Moved Permanently.
Codes people mix up
- 301 and 302: 301 is permanent, so search engines move ranking to the new URL. 302 is temporary. 308 and 307 are the same pair but keep the method, so a POST stays a POST.
- 401 and 403: 401 means log in because credentials are missing or wrong. 403 means the server refuses the request and logging in again will not change that.
- 400 and 422: 400 is a malformed request. 422 is a well-formed request that fails validation.
- 502, 503 and 504: 502 is an invalid reply from an upstream server, 503 is overload or maintenance, and 504 is an upstream server that answered too slowly.
Limits and edge cases
- Unassigned numbers such as 299 or 430 are not listed. RFC 9110 tells clients to treat an unknown code as the x00 code of its class, so an unknown 4xx acts like 400.
- 306 and 418 are reserved as "(Unused)". Some servers still send 418 as a joke.
- 104 Upload Resumption Supported is a temporary registration that expires on 2026-11-13.
Related: MIME type lookup for Content-Type headers, port lookup for service ports and DNS record types.
Frequently asked questions
What is the difference between a 301 and a 302 redirect?
A 301 Moved Permanently tells browsers and search engines the page has a new permanent address, so ranking signals move to the new URL. A 302 Found is temporary, so the original URL stays the one to keep using and indexing.
What is the difference between 401 and 403?
401 Unauthorized means authentication is missing or failed, so the client should log in or send valid credentials. 403 Forbidden means the server understood the request and refuses it, and signing in again will not help if you lack permission.
What does a 502 Bad Gateway error mean?
A gateway or proxy, such as nginx, Cloudflare or a load balancer, got an invalid response from the server behind it. Visitors can reload after a minute. Site owners should check that the origin server is running and look at its logs.
Which status code should an API return for validation errors?
Use 400 Bad Request when the request itself is malformed, such as broken JSON. Many REST APIs use 422 Unprocessable Content when the request is well formed but a field fails validation.
Is 418 I'm a teapot a real status code?
It began as a joke in RFC 2324, the 1998 April Fools Hyper Text Coffee Pot Control Protocol. RFC 9110 now reserves 418 as unused, although some servers still return it for fun.
Sources: IANA HTTP Status Code Registry, RFC 9110 section 15 and Cloudflare 5xx error documentation.